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Even though mutually unbiased bases and entropic uncertainty relations play an important role 
in quantum cryptographic protocols they remain ill understood. Here, we construct special sets of 
up to 2n + l mutually unbiased bases (MUBs) in dimension d — 2" which have particularly beautiful 
symmetry properties derived from the Clifford algebra. More precisely, we show that there exists 
a unitary transformation that cyclically permutes such bases. This unitary can be understood as 
a generalization of the Fourier transform, which exchanges two MUBs, to multiple complementary 
aspects. We proceed to prove a lower bound for min-entropic entropic uncertainty relations for any 
set of MUBs, and show that symmetry plays a central role in obtaining tight bounds. For example, 
we obtain for the first time a tight bound for four MUBs in dimension d = 4, which is attained by an 
eigenstate of our complementarity transform. Finally, we discuss the relation to other symmetries 
obtained by transformations in discrete phase space, and note that the extrema of discrete Wigner 
functions are directly related to min-entropic uncertainty relations for MUBs. 



I. INTRODUCTION 

One of the central ideas of quantum mechanics is the 
uncertainty principle which was first proposed by Heisen- 
berg [T] for two conjugate observables. Indeed, it forms 
one of the most significant examples showing that quan- 
tum mechanics does differ fundamentally from the classi- 
cal world. Uncertainty relations today are probably best 
known in the form given by Robertson [2] , who extended 
Heisenberg's result to two arbitrary observables A and 
B. Robertson's relation states that if we prepare many 
copies of the state \ip), and measure each copy individu- 
ally using either A or B, we have 



AAAB>^M[A,BM\ 



(1) 



where AX = v^(i/;|X2|V') - (V'l^lV')^ for X e {A, B} is 
the standard deviation resulting from measuring lip) with 
observable X. The essence of ([T]) is that quantum me- 
chanics does not allow us to simultaneously specify defi- 
nite outcomes for two non-commuting observables when 
measuring the same state. The largest possible lower 
bound in Robertson's inequality (Tj) is 1, which happens 
if and only if A and B are related by a Fourier transform, 
that is, they are conjugate observables. 

Of particular importance to quantum cryptography is 
the case where A and B correspond to measurements in 
two different orthonormal bases A — {\a)}a and B — 
{|6)}b in dimension d. If A and B are related by the 
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Fourier transform, for all basis vectors \a) of basis A and 
all vectors \b) of basis B, 



\{a\b)\' 



1 

d 



(2) 



Any two bases satisfying this property are called mutu- 
ally unbiased bases, or complementary aspects, and the 
unitary that exchanges two mutually unbiased bases can 
be understood as a Fourier transform. In the light of 
Robertson's uncertainty relation ([T]), it seems that bases 
which are related by the Fourier transform should play a 
special role in our understanding of quantum mechanics, 
in the sense that they are the measurements which are 
most "incompatible" . 

However, nature typically allows us to perform more 
than two measurements on any given system, leading to 
the natural question of how we can determine "incompat- 
ibility" between multiple measurements. Clearly, due to 
its use of the commutator relation, the lower bound of ^ 
most directly relates to the case of two measurements. Is 
there a natural way of quantifying uncertainty for multi- 
ple measurements? And if so, what measurements might 
be most "incompatible"? 



A. Entropic uncertainty relations 

A natural measure that captures the relations among 
the probability distributions over the outcomes for each 
observable is the entropy of such distributions. This 
prompted Hirschmann to propose the first entropic un- 
certainty relation for position and momentum observ- 
ables [5|. This relation was later improved by [H 0, 
where [5] show that Heisenberg's uncertainty relation M 
is in fact implied by this entropic uncertainty relation. 
Hence, using entropic quantities provides us with a much 
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more general way of quantifying uncertainty. Indeed, it 
was realized by Deutsch [6j that other means of quanti- 
fying "uncertainty" are also desirable for another reason: 
Note that the lower bound in ([T]) is trivial when hap- 
pens to give zero expectation on [A, B]. Hence, it would 
be useful to have a way of measuring "incompatibility" 
which depends only on the measurements A and B and 
not on the state. Deutsch [Hj himself showed that 



(Foo(^||V'))+Hoo(^||^)))>-l0g 



- c{A, B) 

"1 



(3) 



where c{A,B) := max{|(a|6)| | \a) E A, \b) E B}, and 

i7oo(^||V^)) = -logmax|(a|7A)|2 (4) 

a 

is the min-entropy arising from measuring the pure state 
IV') using the basis A (see Section III A for more infor- 
mation on the entropic quantities we use). If A and 
B are related by a Fourier transform, then the r.h.s. 
of ^ becomes — log(l/2 + l/{2^/d)), where the mini- 
mum is achieved by a state that is invariant under the 
Fourier transform. Since the Shannon entropy obeys 
H{ ) > Hoo{-), Deutsch's bound also holds for the Shan- 
non entropy. Better lower bounds have since been ob- 
tained for the Shannon entropy by Maassen and Uffink [7] 
following a conjecture of Kraus [8]. Their uncertainty re- 
lations are again strongest (in the sense that the lower 
bound is largest) when the bases A and B are conjugate, 
that is, the two bases are related by a Fourier trans- 
form. Apart from their role in understanding the founda- 
tions of quantum mechanics, these uncertainty relations 
play a central role in cryptography in the noisy-storage 
model [HHIS] , quantum key distribution (TU [TS] , informa- 
tion locking [16] , and the question of separability [17] . In 
particular, such relations have practical interest in noisy- 
storage cryptography [11| where they may enable us to 
prove security for a larger class quantum memories. 

Here, we are concerned with measurements in multiple 
bases Bq, . . . , B^-i. Entropic uncertainty relations pro- 
vide a natural way of quantifying "incompatibility" of 
more than two measurements by lower bounding 



L-l 



(5) 



j=o 



for all states |V'). We call a state jV') that minimizes 
the average sum of entropies a maximally certain state. 
When H is the Shannon entropy, the largest bound we 
can hope to obtain for any choice of bases is 



CL = log d , 



(6) 



since choosing to be an element of one of the bases 
yields zero entropy when we subsequently measure in the 
same basis. If ^ is indeed a lower bound to ([s]), we 
will call the measurements maximally incompatible with 



respect to the Shannon entropy. Note that this can only 
happen if \ip) gives us full entropy [45] when measured 
in any other basis, that is, the bases are all mutually 
unbiased. 

Curiously, however, it was shown that whereas being 
mutually unbiased is necessary, it is not a sufficient con- 
dition to obtain maximally strong uncertainty relations 
for the Shannon entropy [18 . In particular, there do exist 
large sets of up to ^/d mutually unbiased bases in square 
dimensions for which we do obtain very weak uncertainty 
relations [18J. Recently, Ambainis |19jj has shown that for 
any three bases from the "standard" mutually unbiased 
bases construction [301 HI] in prime dimension, the lower 
bound cannot exceed -I- o(l)) logd, for large dimen- 
sions. For dimensions of the form Ak + 3 and 8 /c -I- 5 no 
further assumption is needed, but the proof assumes the 
Generalized Riemann Hypothesis for dimensions of the 
form 8k + 1. Furthermore, for any < e < 1/2, there 
always exist fc = of these bases such that the lower 
bound cannot be larger than (5 + e + o(l)) logd. Only 
if we use the maximal set of d+ 1 mutually unbiased bases 
that can be found for any given prime power dimension, 
do we obtain quite strong uncertainty relations [22l [23] . 

At present, we merely know that there do exist arbi- 
trarily large sets of two outcome measurements that give 
us maximally strong uncertainty relations |24| . and that 
in larger dimensions selecting a large amount of bases at 
random does provide us with strong relations [5S] (for a 
survey see |26j). Indeed, it remains an intriguing open 
question as to whether there even exist three measure- 
ments with three outcomes in dimension d > 2 that are 
maximally incompatible with respect to the Shannon en- 
tropy. 



B. Mutually unbiased bases 

In the light of these questions, it is therefore natural to 
study the structure of mutually unbiased bases(MUBs) to 
see whether we can identify additional properties which 
are sufficient for obtaining strong uncertainty relations. 
In |27j, Wootters and Sussman made the interesting ob- 
servation that for the maximal set oi d+1 mutually un- 
biased bases coming from such constructions as [20l [21] 
in dimension d = 2", the lower bound of the entropic un- 
certainty relation in terms of the collision entropy given 
in |18) is tight, and the minimum is attained by a state 
that is invariant under a unitary that cyclically permutes 
the set of all d-f 1 MUBs. A similar unitary was noted to 
exist by Chau 28 . Wootters and Sussman derive their 
transformation from phase space arguments. Their uni- 
tary can in fact easily be generalized to cyclically permute 
L bases, whenever L divides d -I- 1 (see Section [ill B 2 1 . 
The results in [57] have recently been generalized by Ap- 
pleby |29j , who shows that in prime power dimensions of 
the form d = 1 or 3 mod 4, there exists a unitary opera- 
tion that cyclically permutes the first and second halves 
of the full set of MUBs. This raises the pressing question 
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of whether smaller sets of MUBs also exhibit such sym- 
metries? And can we exploit such symmetries to obtain 
tight uncertainty relations? In particular, is the minimiz- 
ing state always an invariant of such a transformation as 
observed for two bases in ([s]) ? 

Main result We first show by an explicit construction 
that there exist sets oi2 < L < 2n + l mutually unbiased 
bases in dimension d — 2" with the property that there 
exists a unitary that cyclically permutes all bases in this 
set, whenever (a) L is prime, and (b) L divides n or 
L — 2n + 1. More specifically, we provide an explicit 
construction of MUBs Bq, ■ ■ • with Bj = {\b'^^^)}b 

and a unitary U such that 

t/|6(j'))(6(^)|i7^ = + l modL)^^^{j + l modL)| (7) 

for all e Bj . 

Furthermore, in dimension c? = 4, we actually find such 
a unitary for any set of L MUBs, where 2 < L < 5. 
Our approach exploits properties of the Clifford algebra, 
which might yield new insights into the structure of these 
MUBs. It is entirely distinct from the phase space ap- 
proach which was used to construct such a unitary for 
the fuU set oi d + 1 MUBs [50]. Note that our construc- 
tion gives at most 0{logd) bases, but shows that there 
is indeed an additional symmetry which has previously 
gone unnoticed. For L — 2 bases, U is simply the Fourier 
transform, and it would be interesting to investigate gen- 
eral properties of our transformation and whether it has 
applications in other areas. 



C. Min-entropic uncertainty relations 

We then apply our transformation to the study of un- 
certainty relations in terms of the min-entropy (see Q). 
Since H{-) > Hoo{-), this also provides us with bounds 
on uncertainty relations in terms of the Shannon entropy. 
Of course, many forms of entropy could be considered 
when it comes to quantifying uncertainty, and each has 
its merits. The min-entropy is of particular interest in 
cryptography, and is also related to the well studied ex- 
trema of the discrete Wigner function as we will discuss 
in Section |III B 2| In particular, it will be easy to see 
that the average min-entropy for the full set of L = d -I- 1 
MUBs can be bounded as 



bases. For MUBs Bq, . . . , Bl-i we obtain 



1 



-Y.HUBj\m>-\og 



d - (maxl^" 



(8) 



where W^'^^ is the maximum value of the discrete Wigner 
function at the point a in discrete phase space. Sym- 
metries thereby play an important role in determining 

wmax 
a 

Second result We prove a simple min-entropic uncer- 
tainty relation for an arbitrary set of L mutually unbiased 



L-l 



i^i/oo(e,||V'))>-l0g 



J=0 



L - 1 



(9) 



For the case of 2 MUBs in dimension d, this bound is 
indeed the same as the bound in ([3|. For any small set 
of 2 < L < d MUBs, our bound matches the strongest 
known bound [30]. We also prove the following alternate 
lower bound: 



^^iIoo(6,||V» >-l0g 



0=0 



(10) 



which is stronger than ^ for the complete set of L = d+l 
MUBs in dimension d. Clearly, when L — d, the two 
bounds are equivalent. 

We further show that ^ is in fact tight for L = 4 
MUBs in dimension d = 4 stemming from our construc- 
tion, where the minimum is attained for an invariant 
state of the transformation U that cyclically permutes 
all 4 bases. Even though this is a somewhat restricted 
statement, it is the first time that a tight entropic un- 
certainty relation has been obtained for this case. The 
minimizing state here has an appealing symmetry prop- 
erty, just as for the case of L = 2 bases in ^ where the 
minimum is attained by a state that is invariant under 
the Fourier transform. 

For the collision entropy H2, Wootters [27] previously 
showed that the lower bound from [TS] is attained by 
an invariant state when considering the full set of d -I- 1 
MUBs. Here, however, we exhibit a tight uncertainty 
relation for these L = 3 bases in d = 4 for the collision 
entropy H2 which has an entirely different structure and 
the minimum is not attained by an invariant state of our 
transformation. Nevertheless, we have for the first time a 
tight entropic uncertainty relation for all possible MUBs 
in a dimension larger than the trivial case of d = 2 where 
the Bloch sphere representation makes the problem easily 
accessible. In d = 4, we have a tight relation for Hoo for 
L = 2, 4, and tight relations for H2 for L ^ 3,5. 

Our result indicates that due to the different properties 
of the minimizing state for different numbers of bases, 
the problem may be even more daunting than previously 
imagined. Yet, our work shows that in each case the 
minimizing state is by no means arbitrary. It has a well 
defined (albeit different) structure in each of the cases. 

Third result For some sets of MUBs we do obtain 
for the first time, significant insight into the structure of 
the maximally certain states. In particular, we note in 
Section III B 1 that for L mutually unbiased bases that 



the state that minimizes the min-entropic uncertainty re- 
lations is an invariant of a certain unitary whenever L 
divides d -I- 1 for d = 2". 
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II. SYMMETRIC MUBS 

Before explaining our construction of mutually unbi- 
ased bases for which there exists a unitary that cycli- 
cally permutes them, let us define the notions of MUBs 
more formally and recall some known facts. Let Bi = 
{|0«), . . . , Id - iW)} and B2 = {|0(2)), . . . , |d - 1(2))} 
be two orthonormal bases in C^. They are said to 
be mutually unbiased if |(a(^)|fo(2))| — l/Vd, for all 
a, 6 € {0, . . . , d — 1}. A set {Bq, . . . , Bl^i} of orthonor- 
mal bases in C'* is called a set of mutually unbiased bases 
if each pair of bases is mutually unbiased. For example, 
the well-known computational and Hadamard basis are 
mutually unbiased. We use N{d) to denote the maximal 
number of MUBs in dimension d. In any dimension d, 
we have that N{d) < d -I- 1 [H]. If d = p*^ is a prime 
power, we have N(d) = d -I- 1 and explicit constructions 
are known H] . Other constructions are known that 
give less than d -I- 1 MUBs in other dimensions [3TH34] . 
However, it is still an open problem whether there exists 
a set of 7 (or even 4!) MUBs in dimension d = 6. 

A. Clifford algebra 

Our construction of mutually unbiased bases makes es- 
sential use of the techniques developed in [2l], together 
with properties of the Clifford algebra. The Clifford 
algebra is the associative algebra generated by opera- 
tors To, . . . ,r2„-i satisfying {ri,rj} = for j ^ j and 
r| = I. It has a unique representation by Hermitian ma- 
trices on n qubits (up to unitary equivalence) that can 
be obtained via the famous Jordan- Wigner transforma- 
tion [35]: 

r2j+i = (g) Z(8)i®("-^), (11) 

T2j = (g) X (12) 

for j = 0, . . . , n — 1, where we use X, Y and Z to denote 
the Pauli matrices. Furthermore, we let 

:= iTo ■ . ■ T2n-1 ■ (13) 

Note that in dimension d ~ 2 these are just the familiar 
Pauli matrices, Tq = X , Ti — Z and r2 = Y. 

Of particular importance to us will be the fact that 
we can view the operators Tq, . . . ,r2,i-i, as 2n orthog- 
onal vectors forming a basis for K^"^ particular, for 
any orthonormal transformation T S 0(2n) which when 
applied to the vector v — (w(°), . . . , ^(^"-i)) g ]]j2ri gjygg 
V = {v^^\ . . . ,v^'^'^'^^^) — T{v), there exists a unitary 
U{T) such that 

t/(T)|^^«,r,j[/(r)t^^^,r, . (i4) 

The orthonormal transformation that is particularly in- 
teresting to us here is the one that cyclically permutes 



the basis vectors. As described above we can find a cor- 
responding unitary U = U{T) which cyclically permutes 
the basis vectors Tq,T2, . ■ ■ ,T]^_i. An explicit construc- 
tion can be found in the appendix. This symmetry can 
be extended to S0(2n -I- 1), see e.g. [51]. It will also be 
useful that the set of d^ operators 

S = {l,Tj,iTiTj,TiTjTk, . . . , iPi . . .r2„} (15) 

forms an orthogonal basis [46) for d x d Hermitian matri- 
ces in d 2" [36] . 

B. Construction 

To construct mutually unbiased bases, we follow the 
procedure outlined in [21], but now applied to a sub- 
set of the operators in 5 \ {I}. That is, we will group 
operators into classes of commuting operators, i.e., sets 
{Co,Ci, . . . ,Cl_i \Cj ciS\ {!}} of size \Cj\^d-l such 
that 

(i) the elements of Cj commute for all < < L — 1, 

(ii) Cj n Cfc = for aU j ^ k. 

It has been shown in [5T] that the common eigenbases of 
such classes form a set of L MUBs. 

First of all, note that no class can contain two gen- 
erators Tj and F^ since they do not commute. When 
forming the classes we hence ensure that each one con- 
tains exactly one generator Tj, which clearly limits us 
to constructing at most 2n + 1 such classes. The diffi- 
culty in obtaining a partitioning that is suitable for our 
purpose is to ensure that the unitary U that cyclically 
permutes the generators Fq, . . . ,ri_i also permutes the 
corresponding bases by permuting products of operators 
appropriately. We show in the appendix that our general 
construction achieves the following: 

Theorem II. 1. Suppose that 2 < L < 2n + 1 is prime, 
and either L divides n or L ~ 2ri + 1. Then in di- 
mension d = 2", there exist L mutually unbiased bases 
Bq, . . . , Bl^i for which there exists a unitary U that cycli- 
cally permutes them 

UBj = Bj+i mod L ■ (16) 

C. Examples 

Let us consider two simple examples of such classes 
in dimension d = 4. These are not obtained from our 
general construction, but nevertheless provide us with 
the necessary intuition. For L = 3 MUBs the classes are 
given by 

Co = {Fo,iFiF4,«F3F2} 
Ci = {Fi,iF2F4,»F3Fo} 
C2 = {F2,^FoF4,^F3Fl} (17) 
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It is easy to see that the unitary U that achieves the 
transformation Fq — )• Fi — >• r2 — >■ Fq, but leaves F3 and 
F4 invariant, cycUcally permutes the bases given above. 
For the cohision entropy H2 the minimum is attained 
for an eigenstate of the commuting operators Fq, iF2F4 
and iFaFi. This minimizing state also shows that the 
wellknown bound for H2 (see e.g. [261) can be tight. 
For L = 4 MUBs we obtain the classes 

Co = {Fo,iFiF4,iF2F3} 

Ci = {Fi,iF2F4,zF3Fo} 

C2 = {r2,iF3F4,iFoFi} 

C3 - {F3,zFoF4,zFiF2} (18) 

It is easy to see that the unitary U that achieves the 
transformation Fq — > Fi — ^ F2 — >■ F3 — Fq, but leaves F4 
invariant, cyclically permutes the bases given above. For 
L = 4 classes the minimum in the entropic uncertainty 
relation for Hao is attained for a state that is invariant 
under the transformation U. However, we also know that 
for L = 4 or L = 8 classes in dimension d — 8 no parti- 
tioning of operators is possible that satisfies our require- 
ments. Thus, for what values of L and d such a unitary 
can be found, remains an interesting open question. 



We have 

\ogd>H{-)>H2{-)>H^{-)>0, (22) 

and hence uncertainty relations for Ha also provide us 
with a bound on uncertainty relations for Hp whenever 
a > /3. 

Note that intuitively, the min-entropy is determined 
by the highest peak in the distribution and most closely 
captures the notion of "guessing". To see why it is a 
more useful quantity in cryptography than the Shan- 
non entropy, consider the following example distribution 
Px: Let X ^ {0, 1}" and let ccq = 0, . . . , be the all 
string. Suppose that Px{xo) = 1/2 -t- 1/(2"+^) and 
Px{x) = l/(2"+i) for X ^ xq, i.e., with probability 1/2 
we choose xq and with probability 1/2 we choose one 
string uniformly at random. Then H{X) sa n/2, whereas 
Hao{X) « 1! If a; would correspond to an encryption key 
used to encrypt an n bit message, we would certainly not 
talk about security if we can guess the key with proba- 
bility at least 1/2 ! Yet, the Shannon entropy is quite 
high. 

B. Min-entropy and symmetry 



III. UNCERTAINTY RELATIONS 

We now investigate the relationship between the ob- 
served symmetries and entropic uncertainty relations. 



A. Entropic quantities 

Before comparing different uncertainty relations, we 
first provide a short introduction to all the entropic quan- 
tities we will use. The expert reader may safely skip this 
section. In general, the Renyi entropy [37 of order a of 
the distribution obtained by measuring a state lip) in the 
basis B ~ {\b)}b is given by 



1 — a 



log 



\beB 



Indeed, the Shannon entropy forms a special case of 
the Renyi entropy by taking the limit a — > 1, i.e., 
Hi(-) = -ff(-), where we omit the subscript. Of particular 
importance are the min-entropy, for a — > cx): 



ifoo(S||t/.)) = -log max|(&|^)|- 
and the collision entropy 

H2{Bm^-iogY,i\m\ 

beA 



2\2 



(20) 



(21) 



Apart from its cryptographic applications, min- 
entropic uncertainty relations are appealing since the 
problem of determining tight uncertainty relations can 
be simplified considerably in the presence of symmetries. 
Furthermore, these relations bear an interesting relation 
to the extrema of the discrete Wigner function. First of 
all, note that for the min-entropy we have by Jensen's 
inequality that 

L-l 

-Y.H^{B,\p) (23) 

L-l 

log- Emaxtr(p|6(j))(6(^)|) (24) 



> 



where the inequality becomes equality if all terms 
tr(p|6(j))(fe(j)|) are the same. For 5= {b'^^\...,b^ 



L-l) 



(19) {0,...,d-l}x^, define 



(25) 



Note that determining a tight lower bound to ( 24 ) is thus 
equivalent to determining 



max max tr (pPr) 

6 P 



Clearly, any C such that 



Pr < CI for all b 



(26) 



(27) 



thus gives us a lower bound for ([23j). For any set of 
bases, this makes the problem of finding a bound more 
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approachable as it reduces the problem to finding the 
largest eigenvalue for any operator Pj^. In particular, it 
can be phrased as a semidefinite program to minimize C 



such that (27) holds for all b. 



1. Symmetries 

It is now easy to see why symmetries simplify our goal 
of determining tight uncertainty relations. 

Lemma III.l. Suppose that for every h e {0, . . . ,d — 

1} there exists a unitary C/g such that t/glfe'-'-') ~ 
mod L)^J^ Then there exists a b' such that the min- 



imum in ( 23 ) is attained for a state p that is invariant 
under Up . 



Proof. First of all, note that 



and hence for psyn 



tr(p,yn,Pg) = tr(pPg) . 



(28) 



(29) 



In particular, this holds for the state p = corre- 
sponding to the eigenvector [ip) with the largest eigen- 
value of Pp. When looking for the minimizing state on 



the r.h.s of (|23|) we can thus restrict ourselves to states 

Note that in this case, we 



which are invariant under [/i 

b' 

furthermore have that 



1 



tr(p.y„,|6«)(6(^)|) = -tr(pP.) 



(30) 



meaning that the inequality ( 23 1 is tight in case of such 



a symmetry which is our claim. 



□ 



The question of course remains, whether such unitaries 
do exist in general. Wootters and Sussman |20] have 
shown that there exists a unitary U that cyclically per- 
mutes the set of all + 1 MUBs for d = 2" by construct- 
ing a unitary that corresponds to a rotation around the 
origin in phase space. Clearly, by considering the uni- 
tary U'' one can trivially adapt their construction to ob- 
tain a unitary that cyclically permutes L MUBs when- 
ever L ■ k = d + 1. By first translating any point in 
the phase space to the origin, then applying the transfor- 
mation U'' and finally translating the origin back to the 
original point, one can obtain the desired unitaries t/g 
that enable us to find tight bounds for the min-entropic 
uncertainty relations. This is the first time we gain sig- 
nificant insight into the structure of the states that min- 



imize ( 23 ) 



Note that our construction only gives unitaries [/g for 

b — {c, . . . , c) for any c G {0, . . . , d ~ 1}. This means that 
our complementarity transform U, leads to tight bounds 
only if the largest eigenvalue of any Pjj happens to occur 



for a 6 of this form. This is for example the case for 
L = 4 in d = 4, where we do not obtain a unitary from 
the phase space approach of pp] . 



2. Discrete Wigner function 

To see how finding a lower bound for min-entropic un- 
certainty relations for d -I- 1 MUBs relates to finding the 
extrema of the discrete Wigner function, let us first recall 
the properties of the discrete Wigner function. The dis- 
crete phase space is a two-dimensional vector space over a 
finite field F^^, where here we focus on the case of d = 2". 
For every state p, we can associate a function Wa with 
every point a in the discrete phase space, known as the 
discrete Wigner function. For completeness, we provide 
a short summary on how to determine Wa ; a detailed ac- 
count can be found in pS] . First of all, note that the d^ 
points of the discrete phase space can be parititioned into 
d parallel lines each of which contains d points. Any such 
partition is called a striation, and it is known that d + I 
such striations can be found [38, . One may now define 
the discrete Wigner function by relating each striation to 
one of the d -I- 1 possible mutually unbiased bases [38] : 
Let Xf, j denote the 6-th line in the striation j. With each 
such line, we associate a projector 



Q{Xp^)^\b^^^){b(^^\ , 



(31) 



onto the 6-th element of the basis Bj , in a specific order so 
as to satisfy certain symmetry constraints 38 . Defining 
the phase-space point operator 



(32) 



aC\b.j 



one can now define the discrete Wigner function as 

1 



d 



(33) 



The extrema of the discrete Wigner function are defined 
as the minimum and maximum of ( 33 ) over quantum 
states p. 

Note that when considering L = d + 1 mutually unbi- 
ased bases, each point a in the discrete phase space can 
be contained in exactly one line from each basis, as all 
lines in a striation, i.e., one basis are parallel. Hence, 
there is a one-to-one correspondence between points a in 
discrete phase space and vectors 6 € {0, . . . , d — 1}^^+^. 
In terms of the phase space operator this means that 



Aa + 



Pr Note that the maximum of the discrete 



Wigner function 



W^r" = max-tr(A„p) , 
p d 



(34) 



is simply the largest eigenvalue of (or — I) up to a 
factor of 1/d. We thus have that 



C:=d. 



max W^ 



(35) 
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satisfies < CI and the maximum of the discrete Wigner 
function provides a lower bound to the min-entropic un- 
certainty relations as given in ([8|. The extrema VF™^^ 
were evaluated numerically in J39 for small d. Note, 
however, that as noted in Section IIIBl one may use 
symmetries to solve the problem of determining W"^^^ 
directly. 



C. A simple bound 



As mentioned in Section IIIB the problem of finding 
a lower bound for the average min-entropy reduces to 
the problem of finding the maximum eigenvalue of the 
operator Pj^ defined in (25 1. In the appendix, we use a 



result due to Schaffner ^30j obtained using the techniques 
of Kittaneh [40] , to show that for any set of L mutually 
unbiased bases in dimension d, the maximum eigenvalue 
of is bounded by 



1 



L- 1 
Vd 



for all b. 



(36) 



Using this, we obtain the following simple bound for the 
average min-entropy in the appendix 

Lemma III. 2. Let Bq, . . . , Bl-i be a set of mutually 
unbiased bases in dimension d. Then, 



L-l 



J=0 



L - 1 
Vd 



(37) 



For the case of L = 2 MUBs in dimension d, our bound 
exactly matches the well known result of Deutsch (see 
([3])). For 1/ > 2, the only other known lower bound 
for the average min-entropy is the one obtained in |30j . 
where it is shown that for a set of L < Vd MUBs in 
dimension d = 2", the following holds: 

L-l 



3=0 
> -lo 



—=r- max 
Vd o<i<j<L-i 



(38) 



strings as in |30| , via a much simpler argument using only 
the concavity of the log. 

Using an alternate approach involving a Bloch sphere 
like representation of the basis vectors we show 

that the maximum eigenvalue of can be bound differ- 
ently, as follows: 



1 



d-\ 



for all b. 



(40) 



As we show in the appendix, this implies 

Lemma III. 3. Let Bq, . . . , Bl-i be a set of mutually 
unbiased bases in dimension d. Then, 



L-l 



.{B,m> -log 



d-i 

Vl 



(41) 



Notice that this alternate bound on the min-entropy 
is stronger than (37) when L > d. In particular, for 
the complete set of d + 1 MUBs in dimension d, this 
alternate bound in (41) is stronger than any previously 
known bounds. When L = d the two bounds that we 
derive are indeed equivalent. See Figs, [l] and [2] for a 
comparison of our bounds in dimensions d — A and d = 8 
respectively. 
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where X'^,X^ C {0,1}" are subsets of n-bit strings. In 
the case of min-entropic uncertainty relations, these sub- 
sets contain only a single string, which corresponds to 
the peak of the probability distribution induced on the 
state 1^) by the corresponding bases and B^ , so that. 



max \/\X^ 

0<i<j"<L-l 



= 1, 



(39) 



Thus, in dimension d = 2", our bound in (37) is clearly 



the same as (38). The reason we obtain a more general 
bound for L < d + 1 MUBs in any dimension d is that 
we reduce the problem directly to an eigenvalue problem 
without going through the representation in terms of bit 



FIG. 1: Average min-entropy for different sets of MUBs in 
dimension d = 4. 

The crosses denote numerically computed minima of the av- 
erage min-entropy for MUBs obtained using our construction. 
The bound in ( |37[ ) is clearly tight for both L — 3 and i = 4 
MUBs. The second analytical bound in ( |41[ ) is stronger than 
(37) for L = d + 1 = 5 bases. The circle denote s th e aver- 
age min-entropy for the invariant states given in ( 43 1 . For 4 
MUBs in d = 4 the minimum of the average min-entropy is 
indeed attained by states invariant under U. 



Finally, we provide an example of a set of MUBs where 
Lemma |III.2| is tight. For the set of L = 4 MUBs in 



8 



dimension d = 4 constructed from the classes given in 



(18), our bound 



1 ^ 



1 / 3 
4^+2 



0.678 , (42) 



is tight, and the minimum is indeed achieved by a state 
that is invariant under the unitary transform that cy- 
cles through the bases, as defined in ^16^ . As noted 
in Section IIIBl in this case, the largest eigenvalue 
of occurs for a & of the form b = (c, . . . , c) for any 
c e {0, . . . , 3}. The states that achieve the lower bound 
are in fact eigenvectors of U, which can be expressed in 
terms of the MUB basis vectors as follows. 



1 ^ 

-^exp(z^j74)|6(^)), 6e{0,...,3}. 



(43) 
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FIG. 2: Average min-entropy for different sets of MUBs in 
dimension d = 8. 

3 MUBs in dimen- 
is stronger 



The bound in ( 37 1 is close to tight for L 
sion d = 8. The second analytical bound in p4 



than ( 37 1 for L = d+1 = 9 bases. The circle denotes the aver- 
age min-entropy for invariant states constr uct ed in dimension 
d = 8, similar to the states described in (431. For 6 MUBS 
in d = 8, the minimum of the average min-entropy is nearly 
attained by states invariant under U. 



we can find a unitary that cyclically permutes these 
bases, whenever L is prime and L divides n or L = 2n+l. 
This unitary is found by exploiting symmetry properties 
of the Clifford algebra. Our approach is quite distinct 
from the phase space approaches that were previously 
used to show that there exists such a unitary for the set 
of all d-f 1 MUBs gO], or for two halves of the fuU sets of 
MUBs when d = 1 or 3 mod 4 [35] . Our unitary can be 
understood as a generalization of the Fourier transform, 
and it would be interesting to see whether it has other 
applications in quantum information. 

It is an interesting open question to generalize our 
result to other dimensions, or to a different number of 
bases. In prime dimension, one could consider the gen- 
eralized Clifford algebra [JT]. Even though it does not 
have the full S0(2n -I- 1) symmetry, it nevertheless ex- 
hibits enough symmetries to allow an exchange of gener- 
ators. This stems from the way the (generalized) Clifford 
algebra is obtained |1TJ [35] , which permits any transfor- 
mation that preserves the p-norm for p > 2 in dimension 
p. Yet, this is only the first step of our construction. 
As for generalizing our result to any L bases in dimen- 
sion d = 2", we note that it is indeed possible to find 
such classes even when L is not prime, as our example 
for L = 4 in dimension d = 4 shows. However, we also 
know that for L — & classes in dimension d — 16, no 
partitioning of operators can be found satisfying our re- 
quirements. It is an interesting open question as to when 
such a partitioning can be found in general. 

Finally, we use our complementarity transform to ob- 
tain a tight uncertainty relation for the min-entropy for 
L = 4 bases in dimension d = 4. No tight relations are 
known for this case before. We also use a slight general- 
ization of the unitary from |20^ to show that when d = 2" 
and L divides d -f 1, the minimizing state is an invariant 
of a certain unitary. This is the first time that significant 
insight has been obtained on the structure of the min- 
imizing states for min-entropic uncertainty relations for 
mutually unbiased bases. It is an exciting open question 
to obtain tight relations in general, and understand the 
structure of the minimizing states. 
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Appendix A: Constructing the unitary U 

It is well known that for any orthonormal transfor- 
mation T e 0(2n) there exists a corresponding uni- 
tary transformation U(T) [43], where we refer to [44) 
Appendix C] for instructions on how to obtain explicit 
constructions. The transformation we wish to construct 
here, of the form U{T)TjU{T)'^ — Ffc, is thereby particu- 
larly simple to obtain. It can be build up from successive 
rotations in the plane spanned by only two "vectors" Tj 
and Ffc. More specifically, we first construct a unitary 
that corresponds to a rotation around an angle tt/2 in 
the plane spanned by Tj and Tk, bringing F^- to F^. This 
is simply a reflection around the plane orthogonal to the 
midvector between Tj and F^, followed by a reflection 
around the plane orthogonal to Tk- Using the geometric 
properties of the Clifford algebra this corresponds to the 
unitary 

i?,^fc = rfc(F, +Ffe)/V2 . (Al) 

To obtain the desired unitary, we now compose a number 
of such rotations. Let Rj_k = Rj^k ff k is odd, and 
Rj,k = Rk^j ff k is even. Furthermore, let _F = I if L is 
odd, and F — r2nrL_i if L is even. Note that F2nrL_i 
is the unitary that flips the sign of r^-i, but leaves all 
Tj for i ^ 2n and j ^ [L — 1) invariant. We may then 
write 

(7(T) = Fi?o,ii?o,2 . . . i?o,L-i • (A2) 

This unitary hence transforms Fq Fi —> 
Fl-1 — !• Fq, but leaves all other generators F^ for j > L 
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invariant. A similar unitary can be found for any trans- 
formation T g S0(2n + 1) [24], but is more difficult to 
construct explicitly. 



Appendix B: Constructing maximally commuting 
classes of Clifford generators 



respectively under the action of U, property(ii) demands 



that S, n S, 



In ( 17 1 and ( 18 ) we gave examples of constructing L ~ 



3 and i = 4 MUBs in dimension d = 4, such that they are 
cyclically permuted under the action of a unitary U that 
permutes the Clifford generators in d = 4. Here, we show 
by a general construction that it is always possible to 
construct L such classes in dimension d = 2", whenever 
L\n and L is prime. We also outline a construction for 
L = 2n-|- 1 classes, given a unitary U that cycles through 
all 2n + 1 Clifford generators, when 2n + 1 is prime. 

Given the 2n generators of the Clifford algebra in di- 
mension (1 — 2", we consider the set 

s = {i,Tj,irjTk,rjTkri, ...,iTori..T2n~i = r2„}. 

(Bl) 

To generate a set oi L < 2n + 1 MUBs, we seek to group 
the elements of S into L classes of commuting operators, 
ie. sets {Co,Ci, . . . ,Cl-i \ Cj C S\{I}} of size \Cj\ = d-1 
such that 

(PI) The elements of Cj commute for all < j < L — 1, 
(P2) The classs are all mutually disjoint, that is, 

Cj n Cfe = for all j ^ fc, (B2) 

(P3) The unitary U that cyclically permutes the genera- 
tors Fq, . . . , r^-i, also permutes the corresponding 
classes by permuting products of operators appro- 
priately. 

Our approach in obtaining such a set of classes is to first 
pick d — 1 elements for the class Cq and then generate 
the rest of the classes by repeated application of U to 
the elements of Cq. This automatically ensures prop- 
erty (P3). To ensure (PI) and (P2), the d — 1 operators 
Co = {Oi, ©2, • ■ ■ Od-i} must satisfy the following: 

(i) For any pair O,, Oj e Co, [0.„ Oj] = 0, and 

(ii) The operators in Cq cycle through mutually disjoint 
sets of operators under the action of U. 

To understand condition (ii) better, consider an operator 
O, in Co- Then, by construction, C/'=(Oj) £ Ck for < 
k < L — I, assuming we construct a total of L classes. In 
addition, property (ii) implies U^{Oi) ^ Cj, for any j ^ 
k. In other words, given any two operators Oi,Oj G Cq 
that cycle through the sets 

S, = {U^{0{)\Q < fc < L - 1} and (B3) 
Sj = {U''{Oj)\Q<k<L-l} , (B4) 



for all i ^ j and i, j = 1,2,. 



1. 



Finally, we note that no class can contain two gen- 
erators Tj and F^, since they do not commute. When 
forming the classes we hence ensure that each one con- 
tains exactly one generator Tj, which we refer to as the 
singleton F-operator of the class, as opposed to the rest of 
the elements which will be products of F-operators. The 
fact that each class can contain at most one singleton 
operator limits us to constructing a maximum of 2n -t- 1 
such classes. 



1. Mathematical tools 

Before proceeding to outline our construction, we es- 
tablish some useful mathematical facts which will help 
motivate our algorithm for the construction of mutually 
disjoint classes. For the rest of the section, we will work 
with a set of p F-operators {Fq, F2, . . . , Fp_i} that are 
cycled under the action oiU , as follows. 



[/:Fo^Fi^...F„_i^Fo, 



(B5) 



In other words, we are given a set of F-operators whose 
cycle-length is p. 



2. Length-2 operators 



First, we consider sets of products of two F-operators 
of the form F^Fj, which we call length-2 operators. It is 
convenient to characterize such pairs in terms of the spac- 
ing - (S) - between the operators that constitute them. 
The spacing function S, for a given set of p operators, is 
simply defined as: S'(FiFj) = (j — i)modp. Then, the 
following holds: 

Lemma B.l (Unique spacings imply non-inter- 
secting cycles). The action of U on any length-2 op- 
erator TiTj leaves its spacing function S{.) invariant. 
Thus, length-2 operators that have unique spacings cy- 
cle through mutually disjoint sets of operators under the 
action of U . 



Proof Recall, U 
that 



(i+l)modp ■ 



It clearly follows 



{i-\-l)modp^ {j'{'l)modp ) 



5(F 
(j — i) modp 



(B6) 

□ 



3. Higher length operators 

Similar to defining length-2 operators, we refer to any 
product of £ F-operators as a length-£ operator. For op- 
erators of length higher than 2, it becomes convenient 
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to refer to them using their corresponding index sets. 
For example, the operator Ti-^Ti^ ■ ■ -^ii will be simply 
denoted by the index set (ii, 12, • ■ • ii)- In the following 
Lemma, we obtain a condition for any set of length-i* op- 
erators to cycle through mutually disjoint sets under the 
action of U. 

Lemma B.2 (Mutually disjoint cycles for length 

£) . Suppose the length-£ operators (for 3 < £ < p — 1) 
that belong to the class Cq are such that they correspond 
to index sets (zi, 22, . . . , i^) which all sum to the same 
value 



ii + i2 + ■ ■ . + ie = ce modp, V (ii, Z2 



z,)€Co (B7) 



Then, no given index set of length £ can belong to more 
than one class, for prime values of p. 

Proof. Given the operators {Ti-^Ti^ . . .Ti^} g Co, such 
that the corresponding index sets (ii, 12, • ■ ■ ,11) sum to 

ii + «2 + . . . + if = c^modp, V(ii,i2, ...,«£)£ Cq. (B8) 

Under the action of U, these index sets change to 



(ii,i2, ■ ■■ ,i£) {il ',i 



(1) ,-(1) 



(B9) 



= («1+1,«2 + 1, 



1) modp 



For any index set {i{ 



(1) ,-(1) 



,•(1) 



) e Ci the sum 



of the indices corresponding to the new operators 
{r (i)r .(i) . . . r .(i)} g Ci becomes 



,■(1) ^ ,-(1) 



+ 4'^ + ... + 4^^ = (Q + £)modp, (BIO) 
Proceeding similarly, the corresponding operators in the 



class Cfe have index sets (i\ ,i\ 



(fc) ,-(fe) 



. ' ) that sum to 



= (Q + fc £)modp, (Bll) 



for all 4'^^ • ■ • ' 4'^'') ^ ^fc- Thus, starting with a 
constraint on the length-^ operators in Co, we have ob- 
tained a constraint on the corresponding operators in a 
generic class C^. 

Now, to arrive at a contradiction, suppose that an in- 
dex set {ji, j2, ■ ■ ■ 1 ji) whose indices {jm}m take values 
from the set {0, 1, . . . ,p — 1}, belongs to two different 
classes, C^ and C^ (with k ^ k'). The constraint imposed 
by ( Bll[ ) implies 



(q + k £) modp = (c^ -|- k' t) modp 
=^ (fc- fc')^modp = 0. (B12) 

Without loss of generality, let k > k' . Since we can form 
at most p classes, the difference (fc — k') can be at most 
(p — 1). Finally, since ^ < p — 1, condition (B12| cannot 
be satisfied for prime values of p. □ 

Recall that our approach to constructing any p classes 
is to first construct the class Co, and then obtain the rest 



by successive application of U. Therefore, the fact that 
any index set of a certain length £ cannot belong to more 
than one class implies that each length-^ operator in Cq 
cycles through a unique set of length-^ operators under 
U. In other words, the length-^ operators cycle through 
mutually disjoint sets, as desired. 

Lcmma [B.2| thus provides us with a sufficient condition 
for the set of length-f operators in Co to cycle through 
mutually disjoint sets under U, given a set of F-operators 
whose cycle-length is prime-valued. We only need to en- 
sure that the length-^ operators in the first class that we 
construct, Co, correspond to index sets that all sum to 
the same value. This condition is of course subject to 
the constraint that the maximum allowed length for the 
operators in Co (and by extension, in any class) is p — 1. 



4. Constructing 2n + 1 prime classes 

As a warmup, we construct L = 2rt + 1 classes in di- 
mension d = 2", when 2n -I- 1 is prime. This case is 
particularly easy, and illustrates how the results of the 
previous sections will be used in general. 

Theorem B.3 (2n + 1 prime classes). Let tj^-^"") = 
{Fo,...,F2„} denote the complete set of (2n + 1) F- 
operators, and let U be the unitary that cycles through 
all of them, that is, 



U 



Fi 



. r2„- 



F 



2n 



(B13) 



If 2n + I is prime, then there exist 2n -|- 1 classes 
Co,Ci,...C2ri satisfying properties (PI) through (P3). 

Proof. We prove the existence of 2rt -I- 1 classes by 
construction. We first outline an algorithm to pick d — I 
operators that constitute the class Cq. The remaining 
classes are easily obtained by the application of U to 
the elements of Co. Then, we make use of Lemmas IB. 11 



and B.2 to prove that the classes obtained through our 
construction do satisfy the desired properties. 



Algorithm 

1. Pick one of the elements of Q^^^^^\ Fo, as the sin- 
gleton operator. 

2. Pair up the remaining operators in to form 
{n— 1) length-2 operators which commute with Fo, 
as follows, 

A = {FiF2„, F2F2„_i, (B14) 

• ■ • , rn-2rn+37 rn-irTi+2 }, 

where £2 denotes the set of length-2 operators in 
Ci. Since we have left out the pair F„F„+i in the 
middle, we get, |£2| = n — 1. 
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3. Form higher length operators that commute with 
1^2 U {ro}, by combining Fg with appropriate com- 
binations of the length-2 operators. Any operator 
of even length i = 2j is created by combining i pairs 
in £2 • And any operator of odd length ^ = 2j + 1 is 
created by appending Fq to a length- 2j operator. 

Denoting the sets of length-3 operators as £3, 
length-4 operators as £4, and in general, the set 
of length-j operators as Ci, we have. 



lAI - 



£2! = - 1, 
n — 1 
2 

n-1 
3 



A I - lAI 

>C7| - |£6l 



|£2n-^2| — ( ) — 1: | £2ri-l | - |£2n-2 1 • 



Putting together the operators from steps (1), (2), and 
(3) we get the desired cardinality for the class Cq as fol- 
lows: 

2n 



\Co\ = l + (n-l)+^|A 



= 1 + 2(71-1) +2 



n-1 



ri — 1 



n-1 
n-1 



= 2E( )-l-2(2"-i)-l 

i=0 ^ 

= 2" - 1 d - 1 



(B15) 



The rest of the classes are generated by successive 
applications of the unitary U to the elements of Cq, so 

that U : Ci ^ mod 2n+l- 



It is easy to see that the elements of each class satisfy 
property (PI) above - the different length operators 
have been picked in such a way as to ensure that they 
all commute with each other. Similarly, by construction, 
they satisfy property (P3). It only remains to prove 
property (P2), that the classes are all mutually disjoint. 

The elements of £2 correspond to the following set of 
spacings 



S'(£2) = {2n- l,2n-3, ...,5,3} 



(B16) 



which are all distinct. So by Lemma [B.l[ the elements 
of £2 cycle through mutually disjoint sets of length-2 
operators. 

For higher length operators, we first show that our 
construction meets the conditions of Lemma IB. 21 For 



the class Cq, the elements of £2 correspond to index sets 
that satisfy 

C2{Co) - {{ti,i2)\n+i2 = 0mod(2n+ 1)}. (B17) 

The length-2 operators of a generic class Ck similarly sat- 
isfy 

£2(Cfc) = {{ii,i2)\ii + Z2 - 2fc mod (2n + 1)}. (B18) 

Since higher length operators are essentially combina- 
tions of length-2 operators and the singleton operator, 
conditions similar to (BI8I hold for higher length index 



sets as well. Since operators of even length £ — 2j con- 
tain j pairs from £2, the corresponding index sets in Cq 
satisfy 

ii + 12 + ■ ■ ■ + i2j = Omod (2n -I- 1), 

V (ii,Z2,...,Z2j) eCo. (B19) 

Similarly, since the odd length operators have Fq ap- 
pended to the even length operators, the index sets of 
length ^ = 2j + 1 in Cq satisfy, 

ii + »2 + • • • + «2i+i = Omod (2n -I- 1), 

V (ii,i2,...,Z2,+i)eCo.(B20) 

To sum up, for any 3 < £ < 2n, our construction en- 
sures that index sets of length-^ belonging to Cq sum to 
the same value. The conditions of Lemma [8.2 1 are there- 



fore satisfied, with the quantity q in (B7) taking the 
value ci = 0, for all ^ = 3, . . . , 2n. Now, we can simply 
evoke Lemma |B.2| to prove that, when 2n + 1 is prime. 



the higher length operators in Cq cycle through mutually 
disjoint sets of operators. □ 



5. Constructing L\n classes for prime values of L 

Next, we show that it is possible to obtain an arrange- 
ment of operators into L classes in dimension 2" , when L 
is prime and L\n, such that the unitary U that cyclically 
permutes L F-operators also permutes the coresponding 
classes. 

Theorem B.4 {L\n classes for prime L). Suppose U 
is a unitary that cycles through sets of L T- operators from 
the set Q(f^^'-) \ {F2„} in dimension 2", where L is prime 
and L\n. Then there exist L classes Cq,Ci, . . .Cl-i that 
satisfy properties (PI) through (P3). 

Proof: Note that since L|n we have n — rL for some 
positive integer r. The set of 2n Clifford generators 
Fq, Fi, . . . , F2n-i can then be partitioned into 2r sets as 
follows: 



gio) 

?(2r-l) 



{Fo,Fi,...,Fi_i}, 



{r(2r- 



l)Li^(2r-l}L+li ■ 



,F2„-i}(B21) 
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Without loss of generality, we can assume the unitary 
U is constructed such that it cyclically permutes the L 
operators within each set, as follows. 



U 



To 



...^Tl-i^To, 



(2r-l)L 



(2r~l)L- 



Once again, we begin with an algorithm for picking 
d — 1 elements for the class Cq. The algorithm closely 
follows the one outlined in the previous section, barring 
some minor modifications. 



Algorithm 

1. The "middle" element from Q'-^\ ^{l-i)/2: is picked 
as the singleton element of Cq. 

2. The (n — l) length-2 operators which commute with 
r(L--i)/2 are picked as follows - 

(a) pairs are picked from Q'-^^ \ {r(^_i)/2} 



leaving To and r(i_|_i)/2 unused. 



(b) 



L-l 



pairs are picked from each of the sets t/'^-* 



through g(2r-i)^ 



(1) 



(2r-l) 



{rL+ir2L_i, ri+2r2L-2, 

rL+(L-l)/2rL + (L+l)/2 }, 



{ r(2r-l)L + ir2n-l, ^ {2r-\)L+2^ 2n-1 



i (2r-l)L + (L-l)/2r(2r-l)L+(L+l)/2 ] i 

leaving the first operator in each set unused. 

(c) Finally, the unused F-operators from different sets 
are put together as specified below, to get the re- 
maining r length-2 operators: 

•^2^*^^ — { TorL, r2LF3i, . . . , F(2r_2)Lr(2r-l)L }■ 

The set of length-2 operators is then given by 



£2 = 4°^u4'^...u£r"^^u/:^ 

which gives \C2\ = ^ + (2r - 1) (^) + r ^ 
rL - + r = n-l. 

3. Pick higher length operators from S that commute 
with F(i_i)/2 and £2, by combining F(/^_i)/2 with 
appropriate combinations of the length-2 operators. 
As before, any even-length operator of length £ — 
2i is obtained by combining i length-2 operators 
from £2- Any operator of odd- length £ — 2i + 
1, is created by appending F(i_i)/2 to a length-2i 
operator. 



Putting together all the operators created in Steps[l]-[3], 
we get the desired cardinality for the class (see (B15)), 
that is, |Co| = 2" - 1. 

Proof of properties (PI) through (P3): The differ- 
ent length operators have again been picked in such a 
way as to ensure that they all commute with each other. 
Since the remaining L—1 classes are generated by succes- 
sive applications of the unitary U to the elements of Cq, 
we have U : Ci ^ mod l- Thus (PI) and (P3) is 

satisfied. It remains to prove that the classes constructed 
here also satisfy property (P2). 

As in the earlier case of 2n -|- 1 classes, the operators 
in each of the sets {C'^\C^\ . . . ,£3^'^"^^} correspond to 
unique values of the spacing function: 

5(4^) = {L - 2, i - 4, . . . , 1}, e [0, 2r - 1], 



which guarantees, by Lemma |B.1| that these operators 
cycle through mutually disjoint sets under U. Since the 

(2r) 

operators in £2 are formed by combining F-operators 
from different sets Q^^\ each of them cycles through a 
different set of operators under U. Thus we see that 
all the length-2 operators in Co cycle through mutually 
disjoint sets. 

Before we proceed to discuss the higher length opera- 
tors, we make one further observation about the length-2 
operators. The operators in £2 correspond to index sets 
which satisfy 

£2(Ci) = {F,,F,Jzi-|-i2 =Omodi}. (B22) 

In particular, the length-2 operators in the set £(^'') have 
been picked carefully so as to ensure that the above con- 
straint is satisfied. In fact, this was the rationale behind 
leaving out the first operator in each of the sets 5*^*^ while 

(i) 

choosing the corresponding length-2 elements in £2 • 
The higher length operators in Cq can be of two types: 

(a) Those that are comprised of F-operators from a sin- 
gle set t/*^*^ alone, and 

(b) Operators that comprise F-operators from more 
than one set. 

Since a type- (a) operator cannot cycle into a type-(b) 
operator under the action of U, these two cases can be 
examined separately. 



Type- (a): The maximum length that an operator of 
type-(a) can have, as per our construction, is L — 1. We 
have ensured this by leaving at least one operator of each 
of the sets C/*^*^ unused in constructing the length-2 oper- 
ators. Furthermore, the constraint in (B22) implies that 



the index sets corresponding to such higher length oper- 
ators in Co, sum to the same value modulo L. More pre- 
cisely, any even- length index set of length £ — 2j, where 
the indices are all drawn from a given set satisfies 

ii + i2 + ■ ■ ■ + ii — OmodL, 

V (ii,i2,...,«i) eCo. (B23) 
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And any index set of odd length £ = 2j + 1 satisfies 

'L - V 



ll + t2 + ■ ■ ■ + tl = 



mod L, 



y {h,i2,...,ii) eCo. (B24) 

Then, invoking Lemma |B.2| with C( — for even values 
of £ and ce = {L — l)/2 for odd values of £, we see that 
no operator of type- (a) can belong to more than one 
class, for prime values of L. 



Type-(b): An operator of type-(b) is a product of op- 
erators from smaller sets ICj C Q'-j') . Consider a length-^ 
operator, O which comprises £q F-operators from fj^"-', £i 
operators from Q'--^\ and in general, £i from the set Q^'^K 



r r 



Kocgm 



Note that by our construction, the operator O exists in 
more than one class if and only if, for all ICj the product 
of all operators in ICj also belongs to more than one class. 
In what follows, we argue that our construction ensures 
that this is not possible. In particular, given a set of 
length-f operators in Co which can be broken down into 
smaller sets as described above, we will argue that there 
exists at least one set fCj in every such length-^ operator 
O, such that the products of operators in ICj correspond- 
ing to different length-^ operators cycle through mutually 
disjoint sets, as defined earlier. 

Note the following two facts about the subsets JCj. 
First, our construction ensures that any subset ICj C fj(^) 
of a given size £j, satisfies either (B23l or (B24) depend- 



ing on £j being even or odd. Second, note that the maxi- 
mum size of these subsets is f < L. However, in order to 



invoke Lemma B.2 we still require £j to be strictly less 



than L. Our goal is hence to show that every length-^ 
operator must have at least one subset ICj of size £j < L. 

Suppose there exists a length-^ operator such that ev- 
ery subset is of size L. Then, the operator itself has to 
be of length 



£^ £„+£^ + ...+£, 



2r-l 



= 2rL = 2n 



(B25) 



However the maximum value of £ in our construction is 
2ri — 1, implying that atleast one of the 2r subsets must 
be of a size strictly smaller than L. And, for such a subset 



of size less than L, constraints (B23l and (B24| ensure 



that the same subset cannot be found in more than one 
class, provided L is prime. □ 



Appendix C: A simple lower bound on min-entropy 

The min-entropy of the distribution that an orthonor- 
mal basis Bj = {|6^-''')}6 induces on a state p e H is given 

by 

HUBM = -logmaxTr[|6(-'"))(6(^)|p] (CI) 





We are looking to evaluate a lower bound on the average 
min-entropy of any L mutually unbiased bases (not nec- 
essarily coming from our construction) in a d-dimensional 
Hilbert space. The average min-entropy is given by - 



L-l 



\Y.H^{B,\p) = -\Y.^og max 
L L ^ f)(j)Flo d-\\ 



L ^—^ " f)(j)e{o,...,d-i} ' 

2 

L-l 



using Jensen's inequality. The problem of finding an op- 
timal uncertainty relation for the min-entropy, thus re- 
duces to the problem of maximizing over all p G the 

quantity YJ^Zq niaxf,o)g{o,...,<i-i} (^'-^'l P |&^^^)- It is easy 
to see that this maximum is always attained at a pure 
state, so we can restrict the problem to an optimization 
over pure states. We can simplify the problem of finding 
the lower bound of ( C2 1 by recasting it as follows. 
Consider states of the form = Sj=o^ \b^^^) 

where 6 = (5'^"^ fo*^'^^^^) denotes a string of basis 

elements, that is, 6^^^ G {0, 1, d — 1}. Suppose we can 
show for all possible strings 6, 



J) I 



niaxTr(Pj|V)(V|)<C 



(C3) 



Then, since = Tr[Pg|V') (V'l], the bound 

is simply 



L-l 



^^Hoo(6,||V)(V^|)>-logC. (C4) 

We have thus reduced the problem to one of finding the 
maximum eigenvalue of operators of the form P^, over all 

possible strings h. 



1. A new bound for smaller sets of L < d MUBs 



We now prove Lemma III.2[ restated here for conve- 
nience. 

Lemma C.l. Let Bq, . . . ,Bl~i be a set of mutually un- 
biased bases in dimension d. Then, 



L-l 



^^Hoo(6,||^))>-l0g 



j=0 



If L-l 



(C5) 



Proof. Note that by (C4|, it is sufficient to determine 



C in ( C3 1 . To solve this eigenvalue problem we recall 



a result of Schaffner [30] proved using the methods of 
Kittaneh [30], that for a set of L orthogonal projectors 
Aq, Ai, . . . , Al-1, the following bound holds: 



L-l 



V A, II < 1 + (L - 1) max 11 A, A, 

^ ■' 0<j<k<L-l 



(C6) 
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where || (.) || denotes the operator norm, which here is 
simply the maximum eigenvalue for Hermitian operators. 
Applying this result to sums of basis vectors we 
have, 



L-l 

[L-l 



max 

0<j<fe<L-l 



< 1+ (C7) 



which implies 



L 



< 



(C8) 



max 

0<j<k<L-l 



|50-))((j,0-)||5(fe)))(;,(fc)| 



Recall, that for ah fe^^' , 6^=) e {0, . . . , d - 1} 

(fof^'^lfoC^)) = e'"^^, for any j ^ k, (C9) 

where cj) denotes some phase factor. Further, since the 
vectors are normalized, the Cauchy-Schwarz in- 

equality gives 

II |6^^'))(6^''''| II < 1, for any fo^^^fef*^) e {0, . . . ,d - 1}. 



Combining these with ( C8 ) gives the following bound on 
the maximum eigenvalue of the operator : 



Vd 



(CIO) 

By (|C4|), this immediately proves our claim. □ 



2. A stronger bound for the complete set of d + 1 
MUBs 

Here, we present an alternate approach to bound the 
maximum eigenvalue of Pj, using a Bloch vector like rep- 
resentation of the MUB basis states. The bound that we 
obtain here, stated in Lemma [ill. 3[ is stronger than the 
last one when L > d. In particular, when we consider 
the complete set (L = + 1) of MUBs in any dimension 
d, this approach yields the best known bound. 

Lemma C.2. Let Bq, . . . , Bl-i be a set of mutually un- 
biased bases in dimension d. Then, 



1 

-^Hoo(S,||V))>-l0g 



L 



1 



1 



(Cll) 



Proof. First, we switch to working in a basis of Hermitian 
operators, so that every state in Ji has a parametrization 
in terms of vectors in a real vector space. Any state p G H 
can be written as: 



1, 



P = 



(C12) 



where {A^} are Hermitian, trace-less operators that are 
orthogonal with respect to the Hilbert-Schmidt norm: 
Tr[A|'ij] = 2 and the scalars {a^'^ji € M. Thus we 
can parameterize any state in our d-dimensional Hilbert 



space with a vector a. — (a*-^-*,. 



-D) g 



When p is a pure state (Tr[p^] — 1), the vector a cor- 
responding to this pure state satisfies the following nor- 
malization condition 



Tr 



1, 1 



= 1 



1 1 

~d^2 



= 1 



J2 



2{d-l) 



(C13) 



Furthermore, in this representation, the vectors 
{«(bj)} corresponding to the MUB states {|6'-'^)} satisfy 
the following special properties:- 

• (Ml) Normalization: Tr[|Mj'))(6(j)||6(j))(fe(j)|] = 1 

implies that |Q?(ftj)| = \/^^^^^; V 6 G {0,...,d — 
1} , j £ {0, L — 1}. (By an argument similar to 
the one that leads to (C13).) 



(M2) Constant inner-product: \{b^^'>\U^'>)\'^ = ^ im- 
plies that Q((,,j).Q!|.g = 0, V J ^ /c, V 6, 6 G 
{0, d — 1}. This is easily seen, as follows: 



Tr[|6(^))(6(j')||6(''-))(6('=)|] 



1 
d 

= 



(i) (i) _ -L 
"('>j)"(b.fc) - d 



(CM) 



Now, using this representation of MUB states and den- 
sity operators, we can rewrite the maximization problem 
of ((CSl) as: 



max Tr [Pg I ■(/;) (-0 1 ] — max Tr 



< max 



J.5]|6(^))(5«||^)(V'| 




max — 

a L 



1 



7E(i + ^"(''"n.)-" 



d 2 



^+max — 2^a(60)j).a 

3 



(C15) 



Now we only need to find the real (d^ — l)-dimensional 
vector a, that maximizes the sum X]j '^(6(j).j)-'S- If 
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now define an "average" vector corresponding to each 
string b, as follows 



j 



*(avg) 



(C16) 



then, it becomes obvious that the maximum is attained 
when a is parallel to c?''*^s)_ Since it is a vector corre- 



sponding to a pure state, its norm is given by (C13l, so 
that 



thus proving our claim. The second step follows from the 
fact that vectors corresponding to different MUB states 
have zero inner product (see property (M2) above). □ 



a 



(max) 



2{d - 1) a(avg) 
d |a(avg)| 



(C17) 



Note that this maximizing vector has a constant overlap 
with all vectors a'-'''^''^^ for a given string b. In other 
words, for each string 6, the maximum is attained by the 
vector that makes equal angles with all the vectors that 
constitute the "average" vector (a(avg) ) corresponding to 
that string. Note however that this vector may not al- 
ways correspond to a valid state. 

Now that we know the maximizing vector, we can go 
ahead and compute the value of in ( C3 1 . 



niaxTr[Pj|7^)(V;|] < 

m 



1 a(avg)-a(avg) . /2(rf- 1) 



a 



(avg) I 



1, 



*(avg 



2(d- 1) 



1 2{d-l) 
d-1 



where we have used the fact that the vector a 



(avg 



(C18) 
1 have 



a constant norm which can be computed as follows: 

1 



Q^(avg)-Cl(avg) 



L2 ^ 

j 



L2 

1 



a(60) j)-Q!(b(3) j) 
2{d-l) 



a 



(avg) I 



2{d-~l) 



(C19) 



Note that the fact that the bases are mutually un- 
biased was crucial in giving rise to properties (Ml) and 
{M2) which in turn enabled us to identify the maximizing 
vector ttmax- Indeed the maximizing vector correspond- 
ing to a given string b might not always correspond to a 
valid state, in which case the bound we derive cannot be 
achieved. However, there exist strings of basis elements 
6, for which we can explicitly construct a state that has 
equal trace overlap with the states that constitute the 
corresponding operator Pg. These are in fact states of 
the form 



= 7 E I ^^'^ ) ^ I ' ^^e^e ^ = {c, . . . , c} , 



(C20) 



for any c G {0, . . . ,d ~ 1}. Clearly, for the symmetric 
MUBs that we construct, an eigenstate of the unitary 
U that cycles between the different MUBs has the same 
trace overlap with each of the states {|&^-'-'), j = 0, . . . , L— 
1}, for a fixed value of b. To see this, suppose is an 
eigenvector of U with eigenvalue A, then for all < j < 
i — 1 and a given value of b, 



Tr[|M-'"))(6(^)||0)(0|] 



|(6W)|</-)P = |(6«|(C/tri|0)P 
(|Ani(&W|0)P 

(C21) 



This is indeed the case for i = 4 MUBs in d = 4, where 
the lower bound we derive is achieved by eigenstates of 
U. 



